发信人: Tao_Chen@bbs.ustc.edu.cn (绝地战警), 信区: cnhacker
标 题: 解密 教程 2 转载
发信站: 中国科大BBS站 (Mon Feb 23 20:16:39 1998)
转信站: Lilac!ustcnews!ustcbbs
发信人: gongjc (老公), 信区: crack
标 题: cracking universe v1.5b tutorial
发信站: BBS 曙光站 (Sat Nov 29 20:16:20 1997)
How to crack Universe v1.5b
A tutorial by Plushmm
I don't usually take requests (this crack was requested) but since a friend, DiTTo, has seek my help on this, I decided to take a look at it.
Frankly, I found nothing special, the protection used is standard, no big surprises or anything like that AT ALL. The only thing perhaps worth mentioning is that the author has been careful not to "echo" the correct key in memory. Instead, he used
another (basic) trick for the (essential) comparing of your input key and the correct key.
I've also decided to recommend this program as app/week for the week starting 25 Aug 97 at #cracking4newbies. The prez, Joe, says there's no way newbies can handle this one, and so its has become the op's app/week. Some ops have tired and failed...I
hope that by the end of the week, all the ops can crack it, using the sERIAL I provided as a "hint" to cracking it.
You can get the target found: http://www.diardsoftware.com/
Here we go:
Run the program and choose to register:
Enter any crappy info, lets say for the name we use "Plushmm [PC97]"
and for the key we use "1234567"
A messagebox so kindly pops up and tells us
"The registration information you supplied is incorrect."
Lets deadlist the program and search for this...
* Possible Reference to String Resource ID=00001: "Globular Cluster Properties"
|
:00419FF5 6A01 push 00000001
:00419FF7 E82A8F0100 call 00432F26
:00419FFC 8B8798000000 mov eax, dword ptr [edi+00000098]
:0041A002 B9F87A4600 mov ecx, 00467AF8
:0041A007 50 push eax
:0041A008 56 push esi
:0041A009 E8A2030000 call 0041A3B0 ;check reg routine
:0041A00E 85C0 test eax, eax
:0041A010 744C je 0041A05E ;if 0 then <>regged
:0041A012 8B8798000000 mov eax, dword ptr [edi+00000098]
:0041A018 50 push eax
:0041A019 83EC04 sub esp, 00000004
:0041A01C 8965F0 mov dword ptr [ebp-10], esp
:0041A01F 56 push esi
:0041A020 8B4DF0 mov ecx, dword ptr [ebp-10]
:0041A023 E827A90100 call 0043494F
:0041A028 C745FC00000000 mov [ebp-04], 00000000
:0041A02F C745FCFFFFFFFF mov [ebp-04], FFFFFFFF
:0041A036 B9F87A4600 mov ecx, 00467AF8
:0041A03B E8C0020000 call 0041A300
:0041A040 B9F87A4600 mov ecx, 00467AF8
:0041A045 E826010000 call 0041A170
:0041A04A EB20 jmp 0041A06C
:0041A04C B890F64500 mov eax, 0045F690
:0041A051 E91A1A0000 jmp 0041BA70
:0041A056 8B4DF0 mov ecx, dword ptr [ebp-10]
:0041A059 E940AA0100 jmp 00434A9E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A010(C)
|
:0041A05E 6AFF push FFFFFFFF
:0041A060 6A30 push 00000030
* Possible Reference to String Resource ID=01025: "The registration information you supplied is incorrect. Th" ;HERE
|
:0041A062 6801040000 push 00000401
:0041A067 E82F3E0200 call 0043DE9B
Lets look into the Check Reg Routine...
* Referenced by a CALL at Addresses:
|:0041A009 , :0041A2A8 ;called twice!
|
:0041A3B0 53 push ebx ;This routine
:0041A3B1 56 push esi ;converts your
:0041A3B2 57 push edi ;string key into
:0041A3B3 8BF1 mov esi, ecx ;a hex value which
:0041A3B5 55 push ebp ;is stored at
:0041A3B6 33FF xor edi, edi ;EDI (see :0041A40A)
:0041A3B8 33DB xor ebx, ebx ;Also your name gets
:0041A3BA 8B442414 mov eax, dword ptr [esp+14] ;played
:0041A3BE 8B08 mov ecx, dword ptr [eax] ;around
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A3E8(U)
|
:0041A3C0 3B59F8 cmp ebx, dword ptr [ecx-08]
:0041A3C3 7D25 jge 0041A3EA
:0041A3C5 0FBE2C19 movsx ebp, byte ptr [ecx+ebx]
:0041A3C9 03FD add edi, ebp
:0041A3CB 8BC3 mov eax, ebx
:0041A3CD 99 cdq
:0041A3CE 33C2 xor eax, edx
:0041A3D0 2BC2 sub eax, edx
:0041A3D2 83E001 and eax, 00000001
:0041A3D5 33C2 xor eax, edx
:0041A3D7 2BC2 sub eax, edx
:0041A3D9 83F801 cmp eax, 00000001
:0041A3DC 1BC0 sbb eax, eax
:0041A3DE 43 inc ebx
:0041A3DF 83E002 and eax, 00000002
:0041A3E2 48 dec eax
:0041A3E3 0FAFE8 imul ebp, eax
:0041A3E6 03FD add edi, ebp
:0041A3E8 EBD6 jmp 0041A3C0
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A3C3(C)
|
:0041A3EA 8BC7 mov eax, edi
:0041A3EC 0FAFC7 imul eax, edi
:0041A3EF 03C7 add eax, edi
:0041A3F1 33FF xor edi, edi
:0041A3F3 50 push eax
:0041A3F4 E827D7FEFF call 00407B20
:0041A3F9 83C404 add esp, 00000004
:0041A3FC 393E cmp dword ptr [esi], edi
:0041A3FE 7E0A jle 0041A40A
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A408(C)
|
:0041A400 47 inc edi
:0041A401 E83AD7FEFF call 00407B40
:0041A406 393E cmp dword ptr [esi], edi
:0041A408 7FF6 jg 0041A400
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A3FE(C)
|
:0041A40A 8B7C2418 mov edi, dword ptr [esp+18] ;your code
:0041A40E 85FF test edi, edi ;is empty?
:0041A410 7F03 jg 0041A415
:0041A412 8B7E10 mov edi, dword ptr [esi+10]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A410(C)
|
:0041A415 E826D7FEFF call 00407B40 ;this call to "get"
;the correct key for
;your name (in hex)
;eax = correct code
;edi = your code
:0041A41A 2BC7 sub eax, edi ;if eax-edi = 0
;then CORRECT!
:0041A41C 5D pop ebp
:0041A41D 5F pop edi
:0041A41E 83F801 cmp eax, 00000001
:0041A421 1BC0 sbb eax, eax ;if eax = 0 then
;eax := -1
;else eax := 0
:0041A423 5E pop esi
:0041A424 F7D8 neg eax ;if eax = -1 then
;eax := 1
;else eax = 0
;
:0041A426 5B pop ebx
:0041A427 C20800 ret 0008
So what do we have here?
EDI = your code in hex,
EAX = correct code in hex
If CORRECT then at the end before the return, eax = 1, and thus
:0041A00E 85C0 test eax, eax
:0041A010 744C je 0041A05E ;is 0 then <>regged
will not jump since eax = 1
So if you bpx at cs:0041A41A and do a "? eax" the correct key will be shown to you!
Plushmm
--
/^\ /^\ 我是快乐的希思猫 !
( b (^a^) d )
\ " *B* " / makeiTRUNning (tm)
( 'O'"'O' ) WWW: 202.38.73.141/Persons/TaoChen
#==-W-==# EM : bADbOY97@usa.net
( y )
※ 来源: 中国科大BBS站 [bbs.ustc.edu.cn]
Powered by KBS BBS 2.0 (http://dev.kcn.cn)
页面执行时间：219.414毫秒